Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

e555821b54...05.exe

windows7-x64

10

e555821b54...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e555821b5492a3b516940e156657860f00ce034c2149b101e18fb59112ff4905

  • Size

    595KB

  • Sample

    221128-ewe5waea68

  • MD5

    783d2bea764af0c2a775b197a5c2ccc6

  • SHA1

    36f287818b5fb3c703a9b5d6f1790b372b896b68

  • SHA256

    e555821b5492a3b516940e156657860f00ce034c2149b101e18fb59112ff4905

  • SHA512

    781edd5e2c37415cbc386d8af6a09f023794cc1c530ab7ff78cb9952fc4cebfa62b7c881d8158c6bbc4a00a88bf1ec972791d750cc5cd398d88ee1a318e52e0f

  • SSDEEP

    12288:/3k6NsIiLy413Nm2UX+O7FsRYMIAJk8DfCjetsb4XMPfOV:vk6VieGNK+ajMhDfJmb4XeOV

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      e555821b5492a3b516940e156657860f00ce034c2149b101e18fb59112ff4905

    • Size

      595KB

    • MD5

      783d2bea764af0c2a775b197a5c2ccc6

    • SHA1

      36f287818b5fb3c703a9b5d6f1790b372b896b68

    • SHA256

      e555821b5492a3b516940e156657860f00ce034c2149b101e18fb59112ff4905

    • SHA512

      781edd5e2c37415cbc386d8af6a09f023794cc1c530ab7ff78cb9952fc4cebfa62b7c881d8158c6bbc4a00a88bf1ec972791d750cc5cd398d88ee1a318e52e0f

    • SSDEEP

      12288:/3k6NsIiLy413Nm2UX+O7FsRYMIAJk8DfCjetsb4XMPfOV:vk6VieGNK+ajMhDfJmb4XeOV

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks